Novter Trojan Sets its Sights on Microsoft Windows Defender

[silversurfer]

Content source

https://www.bleepingcomputer.com/news/security/novter-trojan-sets-its-sights-on-microsoft-windows-defender/

The Novter Trojan, also known as Nodersok or Divergent, is the latest Trojan to actively target Microsoft's Windows Defender by attempting to disable it.

Last week, three reports came out about a new fileless Trojan that installs Node.JS onto a victim's machines and configures it as a proxy server for click-fraud and other malicious activity. This Trojan is named by Microsoft as Nodersok, Divergent by Cisco Talos, and Novter by Trend Micro.

As previously explained by all three companies, when installed Novter will execute a PowerShell script that disables Windows Defender and modifies Windows Update settings.

According to security researcher Vitali Kremez, who also reverse engineered Novter, the malware will add a variety of Windows policies that disable various functionality in Windows Defender.

Novter Trojan Sets its Sights on Microsoft Windows Defender

The Novter Trojan, also known as Nodersok or Divergent, is the latest Trojan to actively target Microsoft's Windows Defender by attempting to disable it.

www.bleepingcomputer.com

 

[Andy Ful]

On Windows ver. 1903, the WD real-time protection will be reactivated after reboot, even when WD was completely disabled by malware.
This malware is also dangerous for any AV because it can block the Internet connection from AV processes:

Fileless Botnet Novter Spread Via KovCoreG Campaign

We found a new modular fileless botnet malware, which we named “Novter,” that the KovCoreG campaign has been distributing. We’ve been actively monitoring this threat since its emergence and early development, and saw it being frequently updated.

blog.trendmicro.com

 

[ErzCrz]

I'm running WD along with H_C on recommended and CD to High and HardF all presets added. Is tthis sort of here anything else I should be doing to help block this sort of malware?

On Windows ver. 1903, the WD real-time protection will be reactivated after reboot, even when WD was completely disabled by malware.

 

[oldschool]

I'm running WD along with H_C on recommended and CD to High and HardF all presets added. Is tthis sort of here anything else I should be doing to help block this sort of malware?

No, except don't forget brain.exe!

 

[ErzCrz]

Cheers mate

No, except don't forget brain.exe!